Questions on Clang DataflowSanitizer Taint Propagation

To whom it may concern:

Greetings and happy Thanksgiving!
I am using DataflowSanitizer to conduct software engineering-related research at Simon Fraser University, Canada.

First off, why is it that for dfsan_create_label, the userdata is a pointer type,
whereas for dfsan_get_label, the data is a long integer type? Not that I intend to
confront or judge your wisdom in any way, but it seems more intuitive
for the data type of dfsan_get_label and that in the dfsan_label_info structure to match.

Also, after assigning a label to a byte, and copying the byte into another variable,
I should get the label for the original byte if I try to fetch the labels on the said variable;
however, no matter what I do, I get a (null) description and a (nil) data for the variable.
The description and the data are just as expected when I use the original byte to
fetch the label and the dfsan_label_info structure, though.

My Clang version is 3.8, and I am using Lubutu 16.04.

I have attached a PDF of some of the codes that I tried.

DyTan has a dependency hell going on, not to mention being too tightly
coupled with legacy technology (a very old version of Pin that has the files laid out in
a very particular way) and TaintGrind is not quite what I am looking for,
so I am really counting on getting DataFlowSanitizer to work as I want it to.

Thank you for looking into this, and I would appreciate a reply as soon as possible.

Sincerely,

JongJu Park

10_attempts.pdf (113 KB)

To whom it may concern:

Greetings and happy Thanksgiving!
I am using DataflowSanitizer to conduct software engineering-related
research at Simon Fraser University, Canada.

First off, why is it that for dfsan_create_label, the userdata is a
pointer type,
whereas for dfsan_get_label, the data is a long integer type? Not that I
intend to
confront or judge your wisdom in any way, but it seems more intuitive
for the data type of dfsan_get_label and that in the dfsan_label_info
structure to match.

The userdata stored in dfsan_label_info is unrelated to the value passed to
dfsan_get_label. Normally we would expect this value to be numeric, so the
function takes an integer as a parameter.

Also, after assigning a label to a byte, and copying the byte into another

variable,
I should get the label for the original byte if I try to fetch the labels
on the said variable;
however, no matter what I do, I get a (null) description and a (nil) data
for the variable.
The description and the data are just as expected when I use the original
byte to
fetch the label and the dfsan_label_info structure, though.

Can you please attach a small self contained example that demonstrates the
problem? Ideally something along the lines of the test cases in
compiler-rt/test/dfsan.

Peter

Dear Peter:

Thank you for taking your time to respond!

Consider the following code:

It may be a bug, but unless you can provide a self contained example that I can easily run (i.e. a main function, not just code snippets), I can’t help you.

Peter

I have attached two C files.

The first one will be okay, whereas the second one will fail the assertions.

In the second one, it is important to note that dfsan_label bufRegionLabel1 = dfsan_read_label(&buf[someIndex], 1)
still works like it should despite being in a different function,
whereas bufRegionLabel2, 3, 4 do not.

Sincerely,

JongJu Park

taint_prop_1.c (1.27 KB)

taint_prop_2.c (1.32 KB)